Home > Guides > Outdated, unsupported and unlicensed software
Outdated, expired and unlicensed software: the open door most businesses never see
The computer still turns on and the program still opens, so it feels fine. But once software stops getting security updates, every newly discovered flaw stays open forever, and attackers know exactly where to look.
The short version
- CISA, the federal cybersecurity agency, lists using unsupported or end-of-life software as the first entry in its catalog of bad practices.
- Windows 10 lost free security updates on October 14, 2025.
- PCI DSS requires critical security patches within one month of release for businesses that take cards.
- Expired subscriptions (firewall security services, antivirus, Microsoft 365 security) stop protecting even though the device keeps running.
- Unlicensed or pirated software cannot be updated safely and often arrives with malware built in.
What end of life really means
When a vendor declares a product end of life, it is saying no more fixes are coming. Any weakness found after that date stays open. Attackers watch end-of-life dates closely because they know those systems will never be patched.
The federal government calls it a bad practice
The Cybersecurity and Infrastructure Security Agency (CISA) started a catalog of exceptionally risky practices. Number one on the list: use of unsupported or end-of-life software. CISA calls it dangerous and says it significantly elevates risk.
Common examples we find in local offices
- Computers still on Windows 10, or even Windows 7
- Old Office versions that no longer receive security updates
- Accounting, practice management or point of sale software several versions behind
- Firewalls and routers running old firmware or with expired security subscriptions
- Old servers kept running "because they still work"
Expired is the same as unprotected
Many security products are subscriptions. When the license lapses, the firewall keeps passing traffic and the antivirus icon may still show, but threat updates, web filtering and scanning stop. It looks protected and is not. We track renewal dates so nothing quietly expires.
Unlicensed software is a security risk and a legal one
Pirated or improperly licensed software usually cannot receive official updates, and cracked installers are a common way malware gets into a business. Running software you are not licensed for can also lead to audits, back fees and penalties. Every program in your office should be licensed, supported and on a current version.
Compliance and insurance expect current software
PCI DSS requires card-accepting businesses to install critical security patches within one month of release and to keep anti-malware active on every system. HIPAA requires reasonable safeguards for patient data, and cyber insurance applications routinely ask whether systems are supported and patched. Answering yes when it is not true can put a claim at risk.
How we fix it
- Software and license inventory for every computer
- Automatic patching for Windows and common applications
- A renewal calendar for every subscription and license
- An upgrade plan for anything nearing end of life
- Replacement planning when old hardware cannot run supported software
Related guides
Sources
- CISA bad practices catalog (Infosecurity Magazine)
- CISA publishes catalog of poor security practices (Dark Reading)
- Why end-of-life software is a risk (ReliaQuest)
- Windows 10 end of support (HP)
- PCI DSS requirements 5 and 6 explained (Bastion)
- PCI DSS v4.0.1 requirements (Paytia)
This guide is general information for business owners, not legal advice. Laws change; confirm your specific obligations with your attorney, compliance officer or diocese. Last reviewed November 2026.